CVE-2026-106152: External Control of Configuration Setting in Telerik Report Server
In Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration setting vulnerability allows an unauthenticated remote attacker to influence the server address used by Report Server when generating links and notifications. With user interaction, this can lead to disclosure of sensitive information and account takeover.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Telerik Report Serverto a version that resolves this vulnerability.Fixed in 12.3.26.1110
Event History
Frequently Asked Questions
Which deployments are affected?
Progress Telerik Report Server versions earlier than 12.3.26.1110 are affected.
Does exploitation require authentication or user interaction?
An attacker does not need to authenticate to influence the server address used for generated links and notifications. Exploitation leading to sensitive-information disclosure or account takeover requires user interaction.
What security impact can result from successful exploitation?
The issue can cause generated links and notifications to use an attacker-influenced server address. If a user interacts with the resulting content, sensitive information may be disclosed and accounts may be taken over.